Weaknesses of type CWE-942

149 results

Política de segurança entre domínios permissiva com domínios não confiáveis

A aplicação configura mecanismos de controle de acesso entre domínios (como CORS, crossdomain.xml ou equivalentes) de forma muito aberta, permitindo requisições de origens não verificadas ou wildcards. Isso expõe a aplicação a roubo de dados sensíveis, requisições não autorizadas e ataques de CSRF sofisticados, pois qualquer domínio malicioso consegue acessar recursos protegidos.

Example

Um servidor API configura `Access-Control-Allow-Origin: *` sem validar a origem, ou declara um arquivo crossdomain.xml aceitando `<allow-access-from domain="*" />`. Um atacante hospeda um site malicioso que faz fetch para a API e rouba tokens de sessão ou dados do usuário logado no navegador.

How to mitigate

Whitelist explícita: configure CORS ou crossdomain apenas com domínios conhecidos e confiáveis (ex: `Access-Control-Allow-Origin: https://seu-dominio.com`). Valide a origem da requisição no servidor antes de autorizar, nunca use wildcards (*) para recursos sensíveis, e implemente verificações adicionais como SameSite cookies e CSRF tokens.

CVE-2026-9739CRITICALVulnerable to DNS rebinding attacks when using SSE (http://b/499408790). During the beta phase, we implemented `allowed-origins` and `alloweEPSS 0.3%CVE-2026-45021MEDIUMKuma: Default kuma-cp leaks admin token cross-origin via CORS wildcard + LocalhostIsAdminEPSS 0.3%CVE-2025-13017HIGHSame-origin policy bypass in the DOM: Notifications componentEPSS 0.3%CVE-2025-13019HIGHSame-origin policy bypass in the DOM: Workers componentEPSS 0.3%CVE-2026-92359LOWag-ui-protocol ag-ui CORSMiddleware utils.py create_strands_app cross-domain policyEPSS 0.3%CVE-2026-30924CRITICALqui CORS Misconfiguration: Arbitrary Origins TrustedEPSS 0.3%CVE-2026-55110HIGHA malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Origin Resource Sharing (CORS) misconfiguration EPSS 0.3%CVE-2026-27579HIGHCollabPlatform : CORS Misconfiguration Allows Arbitrary Origin With Credentials Leading to Authenticated Account Data ExposureEPSS 0.3%CVE-2026-5302MEDIUMPermissive Cross-domain Policy with Untrusted Domains in coolercontroldEPSS 0.3%CVE-2026-12084MEDIUMIBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to a Permissive Cross-domain Security Policy with Untrusted DomainsEPSS 0.3%CVE-2026-56458MEDIUMHCL DevOps Deploy is susceptible to a Permissive Cross-domain Security Policy with Untrusted DomainsEPSS 0.3%CVE-2026-59148HIGHMockoon: Unauthenticated admin API + wildcard CORS allows mock-state hijack and secret theftEPSS 0.3%CVE-2026-24435HIGHTenda W30E V2 Permissive CORS Allows Cross-origin Data AccessEPSS 0.3%CVE-2026-10056HIGHCORS misconfiguration in Nx Witness VMS allows session token exfiltration via cross-origin requestEPSS 0.2%CVE-2026-115917LOWvLLM: Permissive default CORS origins allow cross-origin requests to the vLLM HTTP serverEPSS 0.2%CVE-2026-34237MEDIUMMCP Java SDK has a Hardcoded Wildcard CORS (Access-Control-Allow-Origin: *)EPSS 0.2%CVE-2023-37401MEDIUMIBM Aspera Faspex cross-origin resource sharingEPSS 0.2%CVE-2026-3303LOWIBM Concert Software Permissive Cross-domain Security PolicyEPSS 0.2%CVE-2026-46431MEDIUMAlgernon: Auto-refresh SSE event server sets Access-Control-Allow-Origin: *EPSS 0.2%CVE-2026-66247MEDIUMiControl is affected by an insecure Cross-Origin Resource Sharing (CORS) policy vulnerability, which could allow a malicious website to execEPSS 0.2%